Marijuana, ATMs and Risk

While there is rhyme and reason to the how and when a compliance exam is scheduled, sometimes it seems like every bank is getting hit at one time…and that time is now. Across the regulatory agencies, there are two areas that are receiving enhanced focus: marijuana banking (no surprise here) and private-owned ATMs (an oldie, but now it’s retro?). Given these areas of focus, we wanted to give you a heads up…our little version of “Know Before…” you have an exam.

On the marijuana-banking front: This $7+ billion industry received quite the hit earlier this year when Attorney General Jeff Sessions announced his decision to rescind the Cole Memo – a document that outlined a 2013 policy in which the government “would not obstruct states that legalized marijuana, on the condition the drug was regulated so as not to hinder key federal enforcement priorities. This included preventing the drugs from being distributed to minors, preventing its movement to other states, and preventing it from being used as a cover for the trafficking of other drugs.[1]” This seemingly single-handed decision threw the marijuana industry, FinCEN and the financial institutions that bank marijuana-related businesses into the upside-down. FinCEN, caught unaware, did not readily have answers for the financial institutions, and the MRBs, about how to proceed.

We saw some initial action shortly after the guidance was rescinded in which 19 Attorneys General sent a letter to Congress, urging our Congressional leaders to advance legislation that would allow states that have legalized medical or recreational use of marijuana to bring that commerce into the banking system. Here we are, almost three months later, with no substantial clarity. However, we aren’t seeing the Feds beat down the doors of (legal) MRBs or shut down the banks offering their services to MRBs. Licenses continue to be issued in states where the drug is legal, and many business owners and banks alike, are preparing to enter the industry.

At this point, the drug remains illegal at the Federal level, and entering the industry means taking on considerable and unknown risk. We aren’t here to sway you one way or the other – just to provide back story as to why this issue has been a focus of recent exams. And, the focus isn’t what you may think. We aren’t seeing the regulators take sides – or even comment at all – only to say that the drug remains illegal at the Federal level. What we are seeing is the push for you to develop and maintain a Marijuana Banking Policy separate from a short blurb in your BSA|AML Policy. We have seen this push consistently among the Federal and state regulators in recent BSA examinations. Whether or not you intend to bank MRBs, the policy requirement – to have a policy in place stating your intention – is the same. To assist you in creating your policy, we have provided a Sample Banking Marijuana Policy with this edition of the Navigator.

Privately owned ATMs are not a new area of risk, but there is a renewed focus on how financial institutions identify whether their customers maintain ATMs in their establishments, lease ATMs for profit, or otherwise engage in privately owned ATM activity.

Money laundering can occur through privately owned ATMs when an ATM is replenished with illicit currency that is subsequently withdrawn by legitimate customers. The owner of the ATM then deposits the proceeds received from the use of the ATMs into a bank account. Consequently, all three phases of money laundering can occur simultaneously. Money launderers could also collude with merchants to provide illicit currency to the ATMs at a discount. Risk could be further increased if the ATMs accept deposits. Illicit funds may be placed into an ATM, mixed with legitimate currency, deposited into a bank account and subsequently used by the owner.

Front-end due diligence is critical in determining whether, and to what extent, risk is presented by your customers’ engagement in privately owned ATM activity. Here’s a snapshot of what you need to know:

§ Does your customer rent or own the ATM(s)?

§ If your customer rents an ATM from a third party, do you know how the arrangement works? Does the third party pay your customer a fee to place the ATM in your customer’s establishment or is it the other way around?

§ How many ATMs are owned?

§ Where are the ATMs located? (e.g. name and location of establishments)

Your policies and procedures, including due diligence and suspicious activity monitoring are key to addressing the risks associated with customers who operate privately owned ATMs. Your due diligence should facilitate the process of determining the level of risk your customer presents to your institution, and how you must administer and monitor the customer’s account(s) going forward. To assistyou in refining your due diligence with respect to privately owned ATMs, we have provided you a Privately Owned ATM Due Diligence Worksheet. Editable Word Form | PDF Form